libxml XML Entity Name Heap Buffer Overflow Vulnerability

Bugtraq ID:	31126
Class:	Boundary Condition Error
CVE:	CVE-2008-3529
Remote:	Yes
Local:	No
Published:	Sep 11 2008 12:00AM
Updated:	Mar 05 2013 06:04PM
Credit:	This issue was disclosed in the referenced Red Hat advisories.
Vulnerable:	XMLSoft Libxml2 2.6.31 XMLSoft Libxml2 2.6.30 XMLSoft Libxml2 2.6.26 XMLSoft Libxml2 2.6.16 XMLSoft Libxml2 2.6.15 XMLSoft Libxml2 2.6.14 XMLSoft Libxml2 2.6.13 XMLSoft Libxml2 2.6.12 XMLSoft Libxml2 2.6.11 XMLSoft Libxml2 2.6.9 XMLSoft Libxml2 2.6.8 + Red Hat Fedora Core2 XMLSoft Libxml2 2.6.7 XMLSoft Libxml2 2.6.6 XMLSoft Libxml2 2.6.5 XMLSoft Libxml2 2.6.4 XMLSoft Libxml2 2.6.3 XMLSoft Libxml2 2.6.2 XMLSoft Libxml2 2.6.1 XMLSoft Libxml2 2.6 .0 XMLSoft Libxml2 2.5.11 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 XMLSoft Libxml2 2.5.10 XMLSoft Libxml2 2.5.8 XMLSoft Libxml2 2.5.4 XMLSoft Libxml2 2.5.1 Xerox FreeFlow Print Server (FFPS) 73.C0.41 Xerox FreeFlow Print Server (FFPS) 73.B3.61 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE openSUSE 10.3 Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 10_x86 Sun Solaris 10_sparc Sun OpenSolaris build snv_99 Sun OpenSolaris build snv_96 Sun OpenSolaris build snv_95 Sun OpenSolaris build snv_92 Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_90 Sun OpenSolaris build snv_89 Sun OpenSolaris build snv_88 Sun OpenSolaris build snv_87 Sun OpenSolaris build snv_85 Sun OpenSolaris build snv_84 Sun OpenSolaris build snv_83 Sun OpenSolaris build snv_82 Sun OpenSolaris build snv_80 Sun OpenSolaris build snv_78 Sun OpenSolaris build snv_77 Sun OpenSolaris build snv_76 Sun OpenSolaris build snv_68 Sun OpenSolaris build snv_67 Sun OpenSolaris build snv_64 Sun OpenSolaris build snv_61 Sun OpenSolaris build snv_59 Sun OpenSolaris build snv_57 Sun OpenSolaris build snv_50 Sun OpenSolaris build snv_39 Sun OpenSolaris build snv_36 Sun OpenSolaris build snv_29 Sun OpenSolaris build snv_22 Sun OpenSolaris build snv_19 Sun OpenSolaris build snv_13 Sun OpenSolaris build snv_100 Sun OpenSolaris build snv_02 Sun OpenSolaris build snv_01 Sun Management Center 3.6.1 Sun Management Center 4.0 Sun Management Center 3.6 Sun Java System Access Manager Policy Agent 2.2 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.2 rPath rPath Linux 2 rPath rPath Linux 1 rPath Appliance Platform Linux Service 2 rPath Appliance Platform Linux Service 1 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Desktop 4.0 RedHat Desktop 3.0 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 Red Hat Enterprise Linux 5 Server Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service - CCSS7 0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Avaya Voice Portal 4.1 Avaya Voice Portal 4.0 Avaya Voice Portal 3.0 Avaya Proactive Contact 4.0 Avaya Proactive Contact 3.0 Avaya Proactive Contact 0 Avaya Messaging Storage Server MM3.0 Avaya Messaging Storage Server 4.0 Avaya Messaging Storage Server 3.1 Avaya Messaging Storage Server 2.0 Avaya Messaging Storage Server 1.0 Avaya Messaging Storage Server Avaya Message Networking MN 3.1 Avaya Message Networking 3.1 Avaya Message Networking Avaya Meeting Exchange - Enterprise Edition Avaya Meeting Exchange 5.0 .0.52 Avaya Meeting Exchange 5.0 Avaya Intuity AUDIX LX 2.0 Avaya EMMC 1.021 Avaya EMMC 1.017 Avaya EMMC 0 Avaya Communication Manager 4.0.3 SP1 Avaya Communication Manager 3.1.4 SP2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Communication Manager 5.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Communication Manager 5.0 SP3 Avaya Communication Manager 5.0 Avaya Communication Manager 4.0 Avaya Communication Manager 3.1 Avaya CMS Server 13.0 Avaya CMS Server 15.0 Avaya CMS Server 14.1 Avaya CMS Server 14.0 Avaya CMS Server 13.1 Avaya Aura SIP Enablement Services 5.0 Avaya Aura Application Enablement Services 4.2.1 Avaya Aura Application Enablement Services 3.1.6 Apple Safari For Windows 3.2.1 Apple Safari 3.2.2 for Windows Apple Safari 3.1.2 for Windows Apple Safari 3.1.2 Apple Safari 3.1.1 for Windows Apple Safari 3.1.1 Apple Safari 3.0.4 Beta for Windows Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.3 Beta Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.2 Beta Apple Safari 3.0.1 Beta for Windows Apple Safari 3.0.1 Beta Apple Safari 2.0.4 Apple Safari 2.0.3 Apple Safari 2.0.2 Apple Safari 2.0.1 + Apple Mac OS X 10.4.2 + Apple Mac OS X 10.4.1 + Apple Mac OS X 10.4 + Apple Mac OS X Server 10.4.2 + Apple Mac OS X Server 10.4.1 + Apple Mac OS X Server 10.4 Apple Safari 1.3.2 Apple Safari 1.3.1 Apple Safari 1.3 + Apple Mac OS X 10.3.9 Apple Safari 1.2.3 Apple Safari 1.2.2 Apple Safari 1.2.1 Apple Safari 1.2 + Apple Mac OS X 10.3.7 + Apple Mac OS X 10.3.7 + Apple Mac OS X 10.3.6 + Apple Mac OS X 10.3.6 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3 + Apple Mac OS X 10.3 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.2 + Apple Mac OS X Server 10.3.7 + Apple Mac OS X Server 10.3.6 + Apple Mac OS X Server 10.3.6 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.2 Apple Safari 1.1 Apple Safari 1.0 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.2 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.2 Apple Safari Beta 2 Apple Safari 4 Beta Apple Safari 3.2 Apple Safari 3.1 for Windows Apple Safari 3.1 Apple Safari 3 Beta for Windows Apple Safari 3 Beta Apple Safari 3 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 1.1.4 Apple iPod Touch 1.1.3 Apple iPod Touch 1.1.2 Apple iPod Touch 1.1.1 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 1.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 1.1 Apple iPhone 1
Not Vulnerable:	Apple Safari 3.2.3 for Windows Apple Safari 3.2.3 Apple Safari 4 for Windows Apple Safari 4 Apple iPod Touch 3.0 Apple iPhone 3.0

libxml XML Entity Name Heap Buffer Overflow Vulnerability

The 'libxml' library is prone to a heap-based buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary within the context of an application using the affected library. Failed exploit attempts will result in a denial-of-service vulnerability.

libxml XML Entity Name Heap Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

The following proof of concept is available:

• /data/vulnerabilities/exploits/31126-PoC.rb

libxml XML Entity Name Heap Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu libxml2-dbg_2.6.32.dfsg-4ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-dbg_2.6.32.dfsg -4ubuntu1.2_powerpc.deb


• Ubuntu libxml2-dev_2.6.32.dfsg-4ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-dev_2.6.32.dfsg -4ubuntu1.2_powerpc.deb


• Ubuntu libxml2-doc_2.6.32.dfsg-4ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-doc_2 .6.32.dfsg-4ubuntu1.2_all.deb


• Ubuntu libxml2-udeb_2.6.32.dfsg-4ubuntu1.2_powerpc.udeb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-udeb_2.6.32.dfs g-4ubuntu1.2_powerpc.udeb


• Ubuntu libxml2-utils_2.6.32.dfsg-4ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-utils_2.6.32.df sg-4ubuntu1.2_powerpc.deb


• Ubuntu libxml2_2.6.32.dfsg-4ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2_2.6.32.dfsg-4ub untu1.2_powerpc.deb


• Ubuntu python-libxml2-dbg_2.6.32.dfsg-4ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/python-libxml2-dbg_2.6. 32.dfsg-4ubuntu1.2_powerpc.deb


• Ubuntu python-libxml2_2.6.32.dfsg-4ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/python-libxml2_2.6.32.d fsg-4ubuntu1.2_powerpc.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu libxml2-dbg_2.6.32.dfsg-5ubuntu4.2_sparc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-dbg_2.6.32.dfsg -5ubuntu4.2_sparc.deb


• Ubuntu libxml2-dev_2.6.32.dfsg-5ubuntu4.2_sparc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-dev_2.6.32.dfsg -5ubuntu4.2_sparc.deb


• Ubuntu libxml2-doc_2.6.32.dfsg-5ubuntu4.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-doc_2 .6.32.dfsg-5ubuntu4.2_all.deb


• Ubuntu libxml2-udeb_2.6.32.dfsg-5ubuntu4.2_sparc.udeb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-udeb_2.6.32.dfs g-5ubuntu4.2_sparc.udeb


• Ubuntu libxml2-utils_2.6.32.dfsg-5ubuntu4.2_sparc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-utils_2.6.32.df sg-5ubuntu4.2_sparc.deb


• Ubuntu libxml2_2.6.32.dfsg-5ubuntu4.2_sparc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2_2.6.32.dfsg-5ub untu4.2_sparc.deb


• Ubuntu python-libxml2-dbg_2.6.32.dfsg-5ubuntu4.2_sparc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/python-libxml2-dbg_2.6. 32.dfsg-5ubuntu4.2_sparc.deb


• Ubuntu python-libxml2_2.6.32.dfsg-5ubuntu4.2_sparc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/python-libxml2_2.6.32.d fsg-5ubuntu4.2_sparc.deb

Debian Linux 4.0 amd64

• Debian libxml2-dbg_2.6.27.dfsg-5_amd64.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_ 2.6.27.dfsg-5_amd64.deb


• Debian libxml2-dev_2.6.27.dfsg-5_amd64.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_ 2.6.27.dfsg-5_amd64.deb


• Debian libxml2-doc_2.6.27.dfsg-5_all.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_ 2.6.27.dfsg-5_all.deb


• Debian libxml2-utils_2.6.27.dfsg-5_amd64.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-util s_2.6.27.dfsg-5_amd64.deb


• Debian libxml2_2.6.27.dfsg-5_amd64.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6. 27.dfsg-5_amd64.deb


• Debian python-libxml2_2.6.27.dfsg-5_amd64.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/python-libxm l2_2.6.27.dfsg-5_amd64.deb

Debian Linux 4.0 ia-32

• Debian libxml2-dbg_2.6.27.dfsg-5_i386.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_ 2.6.27.dfsg-5_i386.deb


• Debian libxml2-dev_2.6.27.dfsg-5_i386.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_ 2.6.27.dfsg-5_i386.deb


• Debian libxml2-doc_2.6.27.dfsg-5_all.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_ 2.6.27.dfsg-5_all.deb


• Debian libxml2-utils_2.6.27.dfsg-5_i386.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-util s_2.6.27.dfsg-5_i386.deb


• Debian libxml2_2.6.27.dfsg-5_i386.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6. 27.dfsg-5_i386.deb


• Debian python-libxml2_2.6.27.dfsg-5_i386.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/python-libxm l2_2.6.27.dfsg-5_i386.deb

Apple Safari 3.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu libxml2-dbg_2.6.32.dfsg-5ubuntu4.2_lpia.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-dbg_2.6.32.dfsg -5ubuntu4.2_lpia.deb


• Ubuntu libxml2-dev_2.6.32.dfsg-5ubuntu4.2_lpia.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-dev_2.6.32.dfsg -5ubuntu4.2_lpia.deb


• Ubuntu libxml2-doc_2.6.32.dfsg-5ubuntu4.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-doc_2 .6.32.dfsg-5ubuntu4.2_all.deb


• Ubuntu libxml2-udeb_2.6.32.dfsg-5ubuntu4.2_lpia.udeb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-udeb_2.6.32.dfs g-5ubuntu4.2_lpia.udeb


• Ubuntu libxml2-utils_2.6.32.dfsg-5ubuntu4.2_lpia.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-utils_2.6.32.df sg-5ubuntu4.2_lpia.deb


• Ubuntu libxml2_2.6.32.dfsg-5ubuntu4.2_lpia.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2_2.6.32.dfsg-5ub untu4.2_lpia.deb


• Ubuntu python-libxml2-dbg_2.6.32.dfsg-5ubuntu4.2_lpia.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/python-libxml2-dbg_2.6. 32.dfsg-5ubuntu4.2_lpia.deb


• Ubuntu python-libxml2_2.6.32.dfsg-5ubuntu4.2_lpia.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/python-libxml2_2.6.32.d fsg-5ubuntu4.2_lpia.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu libxml2-dbg_2.6.32.dfsg-4ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-dbg_2.6.32.dfsg -4ubuntu1.2_sparc.deb


• Ubuntu libxml2-dev_2.6.32.dfsg-4ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-dev_2.6.32.dfsg -4ubuntu1.2_sparc.deb


• Ubuntu libxml2-doc_2.6.32.dfsg-4ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-doc_2 .6.32.dfsg-4ubuntu1.2_all.deb


• Ubuntu libxml2-udeb_2.6.32.dfsg-4ubuntu1.2_sparc.udeb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-udeb_2.6.32.dfs g-4ubuntu1.2_sparc.udeb


• Ubuntu libxml2-utils_2.6.32.dfsg-4ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2-utils_2.6.32.df sg-4ubuntu1.2_sparc.deb


• Ubuntu libxml2_2.6.32.dfsg-4ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/libxml2_2.6.32.dfsg-4ub untu1.2_sparc.deb


• Ubuntu python-libxml2-dbg_2.6.32.dfsg-4ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/python-libxml2-dbg_2.6. 32.dfsg-4ubuntu1.2_sparc.deb


• Ubuntu python-libxml2_2.6.32.dfsg-4ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/libx/libxml2/python-libxml2_2.6.32.d fsg-4ubuntu1.2_sparc.deb

Apple Safari 4 Beta

• Apple Safari4.0BetaSecUpdateLeo.dmg
  Safari for Mac OS X v10.5.7
  http://www.apple.com/safari/download/


• Apple Safari4.0BetaSecUpdateTiger.dmg
  Safari for Mac OS X v10.4.11
  http://www.apple.com/safari/download/


• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu libxml2-dbg_2.6.32.dfsg-5ubuntu4.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-dbg_2 .6.32.dfsg-5ubuntu4.2_amd64.deb


• Ubuntu libxml2-dev_2.6.32.dfsg-5ubuntu4.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-dev_2 .6.32.dfsg-5ubuntu4.2_amd64.deb


• Ubuntu libxml2-doc_2.6.32.dfsg-5ubuntu4.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-doc_2 .6.32.dfsg-5ubuntu4.2_all.deb


• Ubuntu libxml2-udeb_2.6.32.dfsg-5ubuntu4.2_amd64.udeb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-udeb_ 2.6.32.dfsg-5ubuntu4.2_amd64.udeb


• Ubuntu libxml2-utils_2.6.32.dfsg-5ubuntu4.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-utils _2.6.32.dfsg-5ubuntu4.2_amd64.deb


• Ubuntu libxml2_2.6.32.dfsg-5ubuntu4.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2_2.6.3 2.dfsg-5ubuntu4.2_amd64.deb


• Ubuntu python-libxml2-dbg_2.6.32.dfsg-5ubuntu4.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/python-libxml 2-dbg_2.6.32.dfsg-5ubuntu4.2_amd64.deb


• Ubuntu python-libxml2_2.6.32.dfsg-5ubuntu4.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/python-libxml 2_2.6.32.dfsg-5ubuntu4.2_amd64.deb

Debian Linux 4.0 mips

• Debian libxml2-dbg_2.6.27.dfsg-5_mips.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_ 2.6.27.dfsg-5_mips.deb


• Debian libxml2-dev_2.6.27.dfsg-5_mips.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_ 2.6.27.dfsg-5_mips.deb


• Debian libxml2-doc_2.6.27.dfsg-5_all.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_ 2.6.27.dfsg-5_all.deb


• Debian libxml2-utils_2.6.27.dfsg-5_mips.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-util s_2.6.27.dfsg-5_mips.deb


• Debian libxml2_2.6.27.dfsg-5_mips.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6. 27.dfsg-5_mips.deb


• Debian python-libxml2_2.6.27.dfsg-5_mips.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/python-libxm l2_2.6.27.dfsg-5_mips.deb

Apple Safari 3 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 4.0 arm

• Debian libxml2-dbg_2.6.27.dfsg-5_arm.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_ 2.6.27.dfsg-5_arm.deb


• Debian libxml2-dev_2.6.27.dfsg-5_arm.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_ 2.6.27.dfsg-5_arm.deb


• Debian libxml2-doc_2.6.27.dfsg-5_all.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_ 2.6.27.dfsg-5_all.deb


• Debian libxml2-utils_2.6.27.dfsg-5_arm.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-util s_2.6.27.dfsg-5_arm.deb


• Debian libxml2_2.6.27.dfsg-5_arm.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6. 27.dfsg-5_arm.deb


• Debian python-libxml2_2.6.27.dfsg-5_arm.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/python-libxm l2_2.6.27.dfsg-5_arm.deb

Debian Linux 4.0 powerpc

• Debian libxml2-dbg_2.6.27.dfsg-5_powerpc.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_ 2.6.27.dfsg-5_powerpc.deb


• Debian libxml2-dev_2.6.27.dfsg-5_powerpc.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_ 2.6.27.dfsg-5_powerpc.deb


• Debian libxml2-doc_2.6.27.dfsg-5_all.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_ 2.6.27.dfsg-5_all.deb


• Debian libxml2-utils_2.6.27.dfsg-5_powerpc.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-util s_2.6.27.dfsg-5_powerpc.deb


• Debian libxml2_2.6.27.dfsg-5_powerpc.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6. 27.dfsg-5_powerpc.deb


• Debian python-libxml2_2.6.27.dfsg-5_powerpc.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/python-libxm l2_2.6.27.dfsg-5_powerpc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu libxml2-dbg_2.6.32.dfsg-4ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-dbg_2 .6.32.dfsg-4ubuntu1.2_i386.deb


• Ubuntu libxml2-dev_2.6.32.dfsg-4ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-dev_2 .6.32.dfsg-4ubuntu1.2_i386.deb


• Ubuntu libxml2-doc_2.6.32.dfsg-4ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-doc_2 .6.32.dfsg-4ubuntu1.2_all.deb


• Ubuntu libxml2-udeb_2.6.32.dfsg-4ubuntu1.2_i386.udeb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-udeb_ 2.6.32.dfsg-4ubuntu1.2_i386.udeb


• Ubuntu libxml2-utils_2.6.32.dfsg-4ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2-utils _2.6.32.dfsg-4ubuntu1.2_i386.deb


• Ubuntu libxml2_2.6.32.dfsg-4ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2_2.6.3 2.dfsg-4ubuntu1.2_i386.deb


• Ubuntu python-libxml2-dbg_2.6.32.dfsg-4ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/python-libxml 2-dbg_2.6.32.dfsg-4ubuntu1.2_i386.deb


• Ubuntu python-libxml2_2.6.32.dfsg-4ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libx/libxml2/python-libxml 2_2.6.32.dfsg-4ubuntu1.2_i386.deb

Debian Linux 4.0 m68k

• Debian libxml2-doc_2.6.27.dfsg-5_all.deb
  http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_ 2.6.27.dfsg-5_all.deb

Apple Safari 1.0

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.1 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.3 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

libxml XML Entity Name Heap Buffer Overflow Vulnerability

References:

• Multiple Security Vulnerabilities in the XML Library (see libxml2(3)) Bundled Wi (Sun Microsystems)
  
• XMLSoft Homepage (XMLSoft)
  
• Nortel Response to Sun Alert 247346 - Solaris libxml2 Library Vulnerability (Nortel Networks)
  
• ASA-2008-400 - libxml2 security update (RHSA-2008-0884) (Avaya)
  
• ASA-2009-025 A Security Vulnerability in the libxml2 (Avaya)
  
• Solution 247346: A Security Vulnerability in the libxml2 Library May Lead to Den (Sun)
  
• Solution 265329: Security Vulnerabilities in Sun Java System Access Manager Poli (Sun)